Arif Bagas MBCS

Lead Security Architect and Zscaler platform specialist with 30+ years in IT and security, trusted to turn complex Zero Trust ambitions into delivered, production-grade outcomes across enterprise, financial-services, public and insurance environments. Specialises in end-to-end Zscaler ZIA and ZPA delivery — secure web gateway and SSL inspection design, advanced threat protection, sandboxing, CASB and Data Loss Prevention (DLP), AD/SAML/OIDC/SCIM identity integration, RBAC and network segmentation — consistently closing security gaps, de-risking on-prem-to-Azure migrations, and moving greenfield deployments into stable BAU. Equally effective producing HLD/LLD/SAD architecture, building the business case for security investment, automating delivery through Terraform / Infrastructure as Code and network automation, and mentoring engineering teams from design through decommission.

Expert in Zero Trust Network Architecture (ZTNA), cloud security, vulnerability management and SecOps / incident response.

Senior Security Engineer - CRH - Ireland (Remote)

(2026-04 - 2026-07)

• Closed critical Zero Trust Exchange gaps within a three-month engagement by auditing ZIA policies, tunnels and traffic-forwarding feeds, hardening the platform's security posture and removing latent egress exposure across the estate.
• Rationalised PAC-file logic and forwarding profiles to eliminate routing inconsistencies, giving users predictable, policy-compliant access while shrinking the attack surface created by mis-scoped bypasses.
• De-risked the ZIA T1.0→T2.0 migration with a phased roadmap that validated EDR exclusions (Symantec SES & Microsoft Defender) and enforced PAC-file hygiene, so completed waves landed without app or process breakage.
• Implemented GRE/IPSec tunnel / failover runbook to test periodically failover tunnels to service production environment.
• Turned a single-point-of-failure egress path into a resilient, DR-ready connectivity tier by architecting HA Cloud Connectors in Azure with automatic regional failover.
• Converted an unquantified ZTNA blind spot into a board-ready decision, exposing unprotected east-west (cross-region, cloud-to-cloud) and north-south (user-to-internet) traffic and building the business case for a full Zscaler firewall licence.
• Extended data protection to email and outbound channels by integrating Proofpoint Adaptive Email DLP (AEDLP), aligning data handling with regulatory and industry obligations.
• Proofpoint AEDLP connectivity into Splunk siem, providing real time dlp security related policy alerts.

Lead Security Architect - Infosys Limited - London (Remote)

(2024-08 - 2025-12)

• Led the security architecture for a full data-centre-to-Azure migration onto Azure VMware Solution (AVS), giving the business a cloud-native, security-by-design baseline for its applications and databases.
• Produced the HLD/LLD set that made the migration buildable — ZIA integration with Azure Hub-and-Spoke networking, AVS and ExpressRoute — and captured the BOM that let the Terraform team automate Zscaler private service edge / vZen provisioning as repeatable Infrastructure as Code.
• Designed the ZIA policy framework end to end (URL filtering, SSL inspection, advanced threat protection, sandboxing and DLP), and stood up a greenfield Zscaler tenant covering Zidentity, access control, cyber-security and data-protection services, SIPA, CASB, firewall and SSL policy.
• Engineer builds for PSE (vZen & NSS) VAs through to stages, design, testing and production, incorporating high availability fault domains and cross regional failover.
• Migrated ~50 SaaS providers from on-prem ZEN enforcement nodes to Azure vZen proxies, preserving static-IP access for IP-restricted supplier applications throughout cutover.
• Defined and validated SSL inspection architecture and bypass policy through performance/latency POCs, balancing security depth against application compatibility.
• Instrumented the platform for operations by building HA NSS log servers and Syslog/API telemetry pipelines into QRadar and MCAS, then tuned dashboards and alerts so the SOC received signal rather than noise.
• Implemented Zero Trust Network Architecture with a defence-in-depth strategy, achieving full security-tooling migration off-premises; onboarded VMs to CyberArk PAM and implemented certificate rotation.
• Acted as design SME and mentored junior ZIA engineers, keeping web-access and security policy consistent across teams, and carried services through test, knowledge transfer, cutover, BAU handover and decommission.

Airport Engineer - ESP Global Services Ltd - Manchester Airport

(2024-07 - 2024-08)

• Kept airline operations moving by resolving frontline IT incidents within 30 minutes — check-in desks, self-service kiosks, baggage handheld terminals (HHT) and UK Border Force ePassport gates — protecting passenger flow and on-time departures.

Senior Consultant - 6Point6 Ltd (part of Accenture) - London (Remote)

(2023-08 - 2024-02)

• Made the ITHC vulnerability-assessment process repeatable by standardising its documentation, cutting project ramp-up time and giving delivery teams a consistent baseline.
• Turned raw Invicti and Tenable findings into prioritised, actionable Jira remediation tickets, accelerating fix cycles across public and private data-centre projects.
• Translated technical vulnerability findings into business-readable reports, so stakeholders made remediation decisions on real-world impact rather than CVSS scores alone.
• Identified automation opportunities across vulnerability scanning and reporting, reducing manual effort in the assessment pipeline.

Senior Security Engineer — SecOps & Intelligence Analyst (Standby) - MUFG (Link Group) - Leeds (Remote)

(2022-04 - 2023-08)

• Rescued a stalled, business-critical CyberArk PAM programme and delivered it across an 8,000-user global estate — the control maturity that underpinned the firm's £100M cyber-insurance position.
• Brought privileged, service and application accounts under managed PAM and resolved underlying EMEA DNS faults, firewall rules and network visibility lifting the environment into privileged-access compliance.
• Cut lateral-movement risk by designing AD/Entra and SAML group-driven RBAC over ZPA application segments and building fine-grained access profiles that mapped business apps to least-privilege segments.
• Deployed HA-paired ZPA App Connectors across on-prem and cloud footprints, placing and clustering them to optimise latency and resilience for the Zero Trust Exchange.
• Maintained Zscaler ZIA/ZPA security policies and environments.
• Gave the SOC faster detection and cleaner forensics by piping ZIA/ZPA telemetry into Splunk with purpose-built dashboards and alerting.
• Enabled compliant third-party SaaS access by implementing Source IP Anchoring (SIPA) with IP restriction, and tuned Zscaler Client Connector and proxy.pac routing to improve remote performance and reduce user-reported tickets.
• Ran the full incident lifecycle — detection and triage, scoping, in-depth analysis, containment, eradication, recovery and post-incident reporting.
• Contributed to the Splunk on-prem-to-cloud migration, assisted with SailPoint integration.

Network Security Engineer - ArrowXL Ltd (The Very Group) - Wigan (Remote)

(2021-02 - 2022-04)

• Delivered a greenfield hybrid estate end to end (HLD→LLD), migrating production workloads off the incumbent MSP onto purpose-built Primary and Standby data centres with full failover/failback DR proven by test.
• Engineered resilient connectivity — high-speed fibre switching with network segmentation, out-of-band Cisco reachability, and ExpressRoute into Azure — giving the business a hardened, recoverable network